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DETAILED ACTION 

1 . This is a Final Office Action in response to the applicant's application filed on December 
02, 2008. 

2. Claims 1-20 have been examined are pending. 

Response to Arguments 

3. Applicant's arguments filed on December 02, 2008 have been fully considered but they 
are not persuasive. 

The applicant argues that "Nordman fails to teach generating a report for presentation to 
the individual when a third party requests access to information related to the consumer identifier 
and allowing the individual to then control whether this third party, that requested access, can 
access information related to the individual." 

The examiner disagrees with the applicant's analysis and argument because Nordman 
teaches the alleged features as follows: 

Generating a report for presentation to the individual when a third party requests access to 

information related to the consumer identifier discloses as: 

[Nordman: column 3 3 dines 63-67; column 3 4. -lines 1-10] "Regarding the 
Monitor-2 process (step 1410), the supervising authority receives a request from a user 
to identify his/her user information maintained at a receiving site and/or to provide a 
status report on such information at step 1412. At step 1414, the supervising authority 
authenticates the identity of the user to ensure that the object attempting to obtain 
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information on particular user information is entitled to do so. If not, the supervising 
authority terminates the process. Otherwise, at step 1416, the supervising authority 
accesses temporary asset storage at the receiving site to identify user information of the 
user and/or the status of such user information. The status information may for example 
include the violation of any rights management rules, the expiration of access 
authority by the receiving party, the types of use of the user information (e.g., to 
provide personalized service, etc.), access history, and so forth. At step 1418, the 
supervising authority provides the identification information and/or status 
information to the user device that may display such information to the user." 
The above section discloses that a status report is requested by the user and the report is 
generated and presented by the supervisor to the user. The report includes an individual 
consumer identifier (authenticated identity of the user) and the status report related to the user 
identity (consumer identifier) for any activity and violation. 

Allowing the individual to then control whether this third party, that requested access, can access 

information related to the individual discloses as: 

[Nordman: column 34: lines 1-10] "Based on such status or the identification 
of the user information at a site, the user may request the supervising authority to 
delete, update or change the user information, to change the rights management 
rules, and so forth." 

The above section discloses; based on the status report presented to the user (individual) the user 
requests the supervising authority or control whether the third part that requested access can 
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access information related to the individual (to delete, update or change the user information, to 
change the rights management rules, and so forth). 

As discussed above, the alleged feature by the applicant is disclosed by Nordman and 

therefore, the applicant's analysis and argument are not persuasive to overcome the prior art in 
record to place the independent claims in condition for allowance including their corresponding 
dependent claims. 

Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set Ibrlh in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

5. Claims 1-20 are rejected under 35 U.S.C. 103(a) as being unpatentable over Engberg (US 
Pub No.: 2003/0158960 Al) in view of Nordman et al. (hereinafter referred to as Nordman, US 
Pat. No.: 7, 340, 438 B2). 

As per claim 1 : 

Engberg discloses a method for preventing identity theft in electronic communications, 

comprising the steps of: 

sequencing an encryption key transaction from a trusted service for generating for an individual a 
consimier identifier by performing the steps of: 
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(0228-0229; Master key. Client keys, temporary keys; [0260] A Virtual Identity is a 
pseudonym for an individual created for a specific purpose. Using the Trusted Party 
(TP), an individual can assume use a VID to communicate, trade etc. anonymously and 
under full control of the process. [0265] TP— Trusted Party— is generally treated as one 
entity identified by a TP Token Identifier or the public key of TP (TP.Pu) that can be 
verified in ojficial registers such as X500 or X509. [0366] Establish a CLIENTKey which 
is a general symmetric encryption key between TP and CLIENT. [0401] Secret key of 
VID (CI. Vir.Pr) is known only to TP, as TP is backing the authenticity of VID to CLIENT. 
^0400]- [0401];. 

issuing to the individual a unique identifier from said trusted service; and 

([0391] Establish VIZ) (CLIENT/COMPANY). [0395] CLIENT establishes an anonymous 
identity towards a relation under full CLIENT control. [0401] Secret key of VID 
(CI. Vir.Pr) is known only to TP, as TP is backing the authenticit)' of VID to CLIENT.) 

permitting the individual to generate and maintain a consumer-defined sequence through said 
trusted service; and 

([0404] This invention works with a secret shared symmetric key SYMKEY to encrypt 
communication between CLIENT and COMPANY. In the following the SYMKEY is 

treated as if it is reused from session to session; however the SYMKEY can just as well be 
generated as part of establishing a session as a session specific encryption key which is 
saved together with communication encrypted by the public key of CLIENT (Cl.Pu). 
[0405] SYMKEY can be created without revealing this to TP.) 
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allowing the individual to control access to commercially related use of said consumer identifier 
by third parties. 

([0475] When creating a virtual identity on behalf of CLIENT, TP creates a new set of 
signature keys (Cl.Vir.Pr and Cl.Vir.Pu). TP keeps the private key Cl.Vir.Pr which is not 
revealed to anyone else.) 

Engberg does not explicitly disclose generating a report for presentation to the individual 
when at least one of the third parties requests access to information related to the consumer 
identifier; and allowing the individual to control which of the third parties that requested access 
can access information related to the individual. Nordman in analogous art, however discloses 
generating a report when at least one of the third parties requests access to information related to 
the consumer identifier; and allowing the individual to control which of the third parties that 
requested access can access information related to the individual (column 3: lines 20-25; column 
6: lines 35-48; column 7: lines 16-23; coliimn 8: lines 40-51; column 33: lines 63-67; column 34: 
lines 1-19). Therefore, it could have been obvious to a person having ordinary skill in the art at 
the time the invention was made to modify the system disclosed by Engberg to include 
generating a report when at least one of the third parties requests access to information related to 
the consumer identifier; and allowing the individual to control which of the third parties that 
requested access can access information related to the individual. This modification could have 
been obvious because a person having ordinary skill in the art would have been motivated to 
managing user privacy of a user operating a user device such as a wireless device in a network 
environment and determine a context for interaction with a party; filtering user data, such as 
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personal assets, to be provided to the party based on the determined context; and transmitting the 
filtered user data to the party as suggested by (column 1 : lines 53-67). 

As per claim 2: 

Engberg discloses a method, comprising the steps of verifying commercially related use 
of said consumer identifier, comprising the steps of 

initiating a verification process from a requesting business entity via a secure connection 
(0737; 0743); 

comparing said consumer identifier with a pre-determined set of database records using 
said consumer-defined sequence in response to initiating said verification process 
(0489); 

presenting a positive or negative confirmation to said requesting business, said business 

having registered with said trusted service (0491); and 
confirming requested information relating to the individual via said secure connection, 

said requested information have been pre-authorized for presenting to said 

requesting business entity by the individual (0490). 

As per claims 3 and 12: 

Engberg discloses a method and instructions stored on a computer-readable medium, 
comprising the step of reporting to the individual the number of times at least one requesting 
business entity has initiated a verification process (0949-0952). 
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As per claim 4: 

Engberg discloses a method and instructions stored on a computer-readable medium, 
comprising the step of confirming requested information relating to the individual including the 
individual's name, address, and photograph (90279; 0341-0342). 

As per claim 5: 

Engberg discloses a method and instructions stored on a computer-readable medium, 
comprising the step of confirming requested information relating to the individual including the 
individual's fingerprints (0338-0039; 0453). 

As per claim 6: 

Engberg discloses a method and instructions stored on a computer-readable medium, 

comprising the steps of storing said consumer identifier on a remote business database system 
and permitting the individual to modify said consimier identifier through a secure connection to a 
remote location (0694-0696). 

As per claim 7: 

Engberg discloses a method and instructions stored on a computer-readable medium, 
comprising the step of issuing to the individual a unique identifier fi-om said trusted service 
according to a pre-determined set of business rules associated with a remote business database 
system (0270). 
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As per claim 8: 

Engberg discloses a method and instructions stored on a computer-readable medium, 
comprising the step of allowing the individual to control commercial transactions using said 
consumer identifier (0552-0556). 

As per claim 9: 

Engberg discloses a method and instructions stored on a computer-readable medium, 
comprising the step of issuing to the individual a unique identifier from said trusted service, said 
unique identifier conveying in encrypted information relating to the individual's age and locale 
(0881; 0888). 

As per claims 10 and 1 1 : 

Claims 10 and 11 are a system comprising instruction stored on a computer-readable medium for 
performing the steps of claims 1 and 2 respectively. Claims 10 and 1 1 are substantially similar to 
their corresponding method claims 1 and 2; and therefore, they are rejected with the same 
rationale given to reject claims 1 and 2 respectively. 

As per claim 19 and 20: 

Claims 19 and 20 are a computer readable storage medium comprising instruction stored on a 
computer-readable medium for performing the steps of claims 1 and 2 respectively. Claims 19 
and 20 are substantially similar to their corresponding method claims 1 and 2; and therefore, they 
are rejected with the same rationale given to reject claims 1 and 2 respectively. 
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Conclusion 

6. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. See the notice of reference cited in form PTO-892 for additional prior art. 

7. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 



Contact Information 

8. Any inquiry concerning this communication or earlier communications from the 

examiner should be directed to Techane J. Gergiso whose telephone number is (571) 272-3784 
and fax number is (571) 213-^704. The examiner can normally be reached on 9:00am - 6:00pm. 
If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor. 
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Emmanuel Moise can be reached on (571) 272-3865. The fax phone number for the organization 
where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published appUcations 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 

/Techane J. Gergiso/ 
Examiner, Art Unit 2437 



/Emmanuel L. Moise/ 

Supervisory Patent Examiner, Art Unit 2437 



